Debian DLA-913-1 : activemq security update

It was found that Apache ActiveMQ exposed a remote shutdown command in the ActiveMQConnection class. An attacker could use this flaw to achieve denial of service on a client. For Debian 7 'Wheezy', these problems have been fixed in version 5.6.0+dfsg-1+deb7u3. We recommend that you upgrade your...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3265-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3265-2 advisory. USN-3265-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-3264-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3264-1 advisory. Alexander Popov discovered that a race condition existed in the Stream Control Transmission Protocol SCTP implementation in the Linux kernel. A local attacker cou...

CISO Forum 2017

Last week I have attended CISO Forum 2017 in Moscow. I was talking there about "Vulnerability Quadrants: automated hot topic detection in public vulnerability CVE flow". Today I want to share my impressions about the forum itself. To be short, I liked it very much. Both exhibition and...

SUSE SLED12 / SLES12 Security Update : tigervnc (SUSE-SU-2017:1093-1)

This update for tigervnc provides the several fixes. These security issues were fixed : - CVE-2017-7392, CVE-2017-7396: Client can cause leak in VNC server bsc1031886 - CVE-2017-7395: Authenticated VNC client can crash VNC server bsc1031877 - CVE-2017-7394: Client can crash or block VNC server...

Tenable Appliance Unauthorized Administrator Password Manipulation Vulnerability

The Tenable Appliance is a browser-managed application that hosts a variety of Tenable enterprise applications, including Nessus, SecurityCenter SC and Passive Vulnerability Scanner PVS. An unauthorized administrator password manipulation vulnerability exists in Tenable Appliance, which can be...

Tenable Appliance Arbitrary Command Execution Vulnerability

Tenable Appliance is a browser management program developed by Tenable Network Security. An arbitrary command execution vulnerability exists in Tenable Appliance versions 3.5 through 4.4.0. A remote attacker can inject arbitrary commands by manipulating the tnsappliancesessionuser parameter...

CVE-2017-8050

Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...

CVE-2017-8050

Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...

CVE-2017-8051

Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...

Command injection

Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...

Design/Logic Flaw

Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...

CVE-2017-8051

Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...

CVE-2017-8051

Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...

CVE-2017-8051

CVE-2017-8051 affects Tenable Appliance 3.5–4.4.0 (and possibly earlier) via the simpleupload.py Web UI. The flaw allows arbitrary command execution by manipulating the tns_appliance_session_user parameter, enabling unauthenticated, remote code execution as described in multiple sources (e.g., Re...

CVE-2017-8050

Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...

CVE-2017-8050

CVE-2017-8050 affects Tenable Appliance 4.4.0 (and possibly earlier) where a flaw in the Web UI enables unauthorized manipulation of the administrator password. The vulnerability is exploited via the Web UI without authentication, with potential impact on integrity (admin password changed by an a...

Tenable Appliance < 4.5.0 Web UI simpleupload.py Remote Command Execution (CVE-2017-8051)

The remote Tenable Appliance host is affected by a remote command execution vulnerability in the web user interface in the simpleupload.py script due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via the 'tnsappliancesessionuser' parameter, t...

Debian DLA-903-1 : hunspell-en-us update

The dictionary provided by this package had an unnecessary unversioned conflict against the thunderbird package which recently got reintroduced into Wheezy. For Debian 7 'Wheezy', this problem has been fixed in version 20070829-6+deb7u1. We recommend that you upgrade your hunspell-en-us packages...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2017-1108)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1108 advisory. 1:1.8.0.131-2.b13 - Backport 'S8153711: REDO JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command' - Resolves: rhbz1442162...